CVE-2012-3866: Low severity puppet vulnerability
lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for lastrunreport.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
Other sources
From puppet labs: CVE-2012-3866 (lastrunreport.yaml is world readable)
A bug in Puppet 2.7.17 leaves lastrunreport.yaml world readable.
The most recent Puppet run report is stored on the Puppet master with world-readable permissions. The report file contains the context diffs of any changes to configuration on an agent, which may contain sensitive information that an attacker can then access. The last run report is overwritten with every Puppet run.
Note: This only affects the 2.7 series of Puppet.
Resolved in Puppet 2.7.18
— Red Hat
lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for lastrunreport.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3866?
CVE-2012-3866 is considered a medium severity vulnerability due to potential exposure of sensitive configuration information.
How do I fix CVE-2012-3866?
To fix CVE-2012-3866, upgrade Puppet to version 2.7.18 or higher.
What does CVE-2012-3866 affect?
CVE-2012-3866 affects Puppet versions 2.7.x prior to 2.7.18 and Puppet Enterprise versions prior to 2.5.2.
Can CVE-2012-3866 be exploited remotely?
CVE-2012-3866 requires local access to the puppet master server to exploit the vulnerability.
What information is exposed by CVE-2012-3866?
CVE-2012-3866 may expose sensitive configuration information contained in the last_run_report.yaml file.